flux fleet digest — 2026-09-18 08:09 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
4207 |
142 |
3623 |
79 |
+16% |
| canary-farm-1 |
5437 |
165 |
4117 |
99 |
+32% |
| control-1 |
3082 |
124 |
3572 |
42 |
-14% |
| frantech-ts |
76 |
35 |
6186 |
34 |
-99% |
| netcup-ts |
794 |
111 |
894 |
28 |
-11% |
| ru-edge-1 |
2365 |
114 |
2318 |
30 |
+2% |
| sponge-01-ts |
1597 |
134 |
1018 |
32 |
+57% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| canary-farm-1 |
app-config-python |
40 |
12.5 |
3.2x |
| canary-farm-1 |
env-production |
402 |
118.4 |
3.4x |
| canary-farm-1 |
rails-database-yml |
22 |
7.2 |
3.0x |
| canary-farm-1 |
tarpit-disconnect |
105 |
33.3 |
3.2x |
| canary-farm-1 |
tarpit-module |
2565 |
807.4 |
3.2x |
| canary-farm-1 |
wp-config |
40 |
11.8 |
3.4x |
| sponge-01-ts |
phpmyadmin-login |
22 |
6.0 |
3.7x |
| sponge-01-ts |
tarpit-disconnect |
38 |
11.3 |
3.4x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
82 |
576 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 4b4cc0ece037 ⟳ |
13 |
91 |
control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] |
| 7e61a9500d8b ⟳ |
10 |
490 |
canary-farm-1,control-1,netcup-ts,ru-edge-1 ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 321f17b2aca0 ⟳ |
8 |
64 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 1cf777711bea ⟳ |
6 |
54 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-03 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module] |
| 7ea1125e0232 ⟳ |
6 |
85 |
ai-devbox-1,canary-farm-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 218630667b2c ⟳ |
5 |
210 |
ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| canary-farm-1 |
/seeds/aws_credentials.env.local |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/etc/client_secrets.json.rc1 |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/.git/.env.debug.backup |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/azure/.git/config4 |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/api/v1/namespaces/default/secrets |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/.config/aws_credentials |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/secrets.txt2024 |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/jenkins/config.yml_production |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/scala/.env.old_production |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/srv/.env.production.temp |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/gcp/secrets.txt-old |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/panel/secrets.json3 |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/rpc/secrets.txt-old |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/client_secret.json.archived |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/php/.env.production.backup |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/src/main/resources/application.properties |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/.credentials/mail.env |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/.oci/oci_api_key.pem |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/packages/app/.env |
2026-09-18 04:09:25.664450-04:00 |
| canary-farm-1 |
/packages/client/.env |
2026-09-18 04:09:25.664450-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| netcup-ts |
Mozilla/5.0 (Linux; Android 9; Pixel) AppleWebKit/537.36 (KH |
2026-09-18 04:09:39.634492-04:00 |
| ai-devbox-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-18 04:09:39.634492-04:00 |
| control-1 |
Mozilla/5.0 (Linux; Android 7.0; LGMS550 Build/NRD90U) Apple |
2026-09-18 04:09:39.634492-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Geck |
2026-09-18 04:09:39.634492-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Fire |
2026-09-18 04:09:39.634492-04:00 |
| ru-edge-1 |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_3 like Mac OS X) Apple |
2026-09-18 04:09:39.634492-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ |
2026-09-18 04:09:39.634492-04:00 |
| frantech-ts |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l |
2026-09-18 04:09:39.634492-04:00 |
| control-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/ |
2026-09-18 04:09:39.634492-04:00 |
| sponge-01-ts |
Mozilla/5.0 (Linux; Android 9; G8141) AppleWebKit/537.36 (KH |
2026-09-18 04:09:39.634492-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
2a01:e0a:3be:cec0:f54c:335a:8d29:be |
1857 |
33 |
632 |
09-17 16:58 |
09-17 17:05 |
- |
Free SAS |
FR |
0 |
| ru-edge-1 |
204.76.203.18 |
1815 |
2 |
568 |
09-17 04:09 |
09-18 07:39 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| control-1 |
204.76.203.18 |
1799 |
2 |
574 |
09-17 04:09 |
09-18 07:40 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
176.65.144.71 |
1500 |
98 |
743 |
09-18 06:02 |
09-18 06:02 |
- |
Dedik Services Limited |
CH |
0 |
| ai-devbox-1 |
94.154.46.244 |
1285 |
98 |
743 |
09-17 09:24 |
09-17 09:24 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
94.154.46.242 |
900 |
95 |
450 |
09-17 08:56 |
09-17 08:56 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
195.178.110.159 |
384 |
2 |
372 |
09-18 05:39 |
09-18 05:39 |
ipsum:1 |
Techoff Srv Limited |
BG |
0 |
| canary-farm-1 |
213.177.179.52 |
282 |
6 |
11 |
09-17 20:57 |
09-17 20:57 |
- |
Feo Prest SRL |
TW |
2 |
| control-1 |
213.177.179.52 |
282 |
6 |
11 |
09-17 21:15 |
09-17 21:16 |
- |
Feo Prest SRL |
TW |
2 |
| canary-farm-1 |
192.253.248.94 |
282 |
6 |
11 |
09-17 20:29 |
09-17 20:29 |
ipsum:2 firehol2 |
Limited Network LTD |
NL |
2 |
| ai-devbox-1 |
213.177.179.52 |
282 |
6 |
11 |
09-17 20:55 |
09-17 20:55 |
- |
Feo Prest SRL |
TW |
2 |
| sponge-01-ts |
213.177.179.52 |
282 |
6 |
11 |
09-17 21:15 |
09-17 21:15 |
- |
Feo Prest SRL |
TW |
2 |
| control-1 |
192.253.248.94 |
282 |
6 |
11 |
09-17 20:32 |
09-17 20:33 |
ipsum:2 firehol2 |
Limited Network LTD |
NL |
2 |
| netcup-ts |
213.209.159.154 |
247 |
7 |
245 |
09-17 08:25 |
09-17 08:25 |
- |
Feo Prest SRL |
DE |
0 |
| ai-devbox-1 |
196.89.218.205 |
152 |
15 |
38 |
09-18 00:54 |
09-18 00:59 |
- |
Office National des Postes e |
MA |
18 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ru-edge-1 |
5 |
3 |
| control-1 |
5 |
3 |
| ai-devbox-1 |
24 |
11 |
| canary-farm-1 |
36 |
13 |
Mint failures (24h): none
Mints by type label:
| sensor |
types |
mints |
| control-1 |
["aws"] |
5 |
| ai-devbox-1 |
["aws"] |
24 |
| canary-farm-1 |
["aws"] |
36 |
| ru-edge-1 |
["aws"] |
5 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2868
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
3535 |
| ai-devbox-1 |
https |
672 |
| canary-farm-1 |
http |
3243 |
| canary-farm-1 |
https |
2194 |
| control-1 |
http |
3082 |
| frantech-ts |
http |
76 |
| netcup-ts |
http |
794 |
| ru-edge-1 |
http |
2365 |
| sponge-01-ts |
http |
1597 |
Top Host headers:
| sensor |
host |
events |
| ai-devbox-1 |
217.15.163.226 |
3223 |
| control-1 |
38.54.2.209 |
3062 |
| canary-farm-1 |
109.123.246.142 |
2918 |
| canary-farm-1 |
sso.rightabouteverything.show |
2508 |
| ru-edge-1 |
130.94.89.46 |
2356 |
| sponge-01-ts |
89.167.72.144 |
1519 |
| ai-devbox-1 |
inference.fapthropic.com |
956 |
| netcup-ts |
159.195.21.150 |
702 |
| frantech-ts |
209.141.62.110 |
69 |
| sponge-01-ts |
poland.payu.com |
10 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (5 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
| 2026-09-12 |
1813 |
51 |
| 2026-09-11 |
481 |
35 |
| 2026-09-10 |
5026 |
95 |
| 2026-09-09 |
3265 |
68 |
| 2026-09-08 |
3376 |
120 |
| 2026-09-07 |
3256 |
108 |
| 2026-09-06 |
2523 |
99 |
| 2026-09-05 |
3958 |
98 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
176.65.144.71 |
98 |
/config.php [app-config-php] → /settings.php [app-config-php] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /wp-config.php.old [wp-config] → /config.json [config-json] → /wp-config.php~ [wp-config] → /configuration.php [app-config-php] → /local_settings.py [app-config-python] → /.ssh/authorized_keys [authorized-keys-error] → /docker-compose.yaml [docker-compose] → /docker-compose.override.yml [docker-compose] |
Dedik Services Limited |
CH |
| ai-devbox-1 |
94.154.46.244 |
98 |
/.git/HEAD [fake-git] → /.git/config [fake-git] → /wp-config.bak [wp-config] → /config/database.php [app-config-php-database] → /config/app.php [app-config-php-services] → /Gemfile.lock [not-handled] → /composer.json [not-handled] → /.git/index [fake-git] → /config.py [app-config-python] → /docker-compose.yml [docker-compose] → /config.js [webapp-config-bundle-js] → /.dockerenv [not-handled] |
Omegatech LTD |
US |
| ai-devbox-1 |
94.154.46.242 |
95 |
/settings.php [app-config-php] → /configuration.php [app-config-php] → /.git/HEAD [fake-git] → /wp-config.bak [wp-config] → /.aws/credentials [aws-credentials-file] → /.git/config [fake-git] → /wp-config.php.old [wp-config] → /.git/index [fake-git] → /config/database.php [app-config-php-database] → /wp-config.php~ [wp-config] → /wp-config.old [wp-config] → /composer.lock [not-handled] |
Omegatech LTD |
US |
| canary-farm-1 |
2a01:e0a:3be:cec0:f54c:335a:8d29:be |
33 |
/aws/secrets.env [env-production] → /azure/secrets.env [env-production] → /.github/actions/secrets.env [not-handled] → /.config/aws_credentials.env.disabled [not-handled] → /secrets.env.production [not-handled] → /azure_credentials.env.rc1 [not-handled] → /database/azure_credentials.env_staging [phpmyadmin-login] → /aws_credentials.env.temp [not-handled] → /aws_credentials.env.orig [not-handled] → /docker/azure_credentials.env.sample [not-handled] → /aws_credentials.env.src [not-handled] → /deployment/client_secrets.json.dev [not-handled] |
Free SAS |
FR |
| canary-farm-1 |
178.16.54.184 |
32 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /products [not-handled] → /about [not-handled] → /login [webapp-form-login] → /register [webapp-form-signup] → /swagger.json [openapi-spec-json-issued] → /blog [not-handled] → /contact [webapp-form-contact] → /signup [webapp-form-signup] → /docs [openapi-swagger-ui-html] |
Omegatech LTD |
NL |
| ai-devbox-1 |
178.16.54.184 |
32 |
/ [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /about [not-handled] → /swagger.json [openapi-spec-json-issued] → /contact [webapp-form-contact] → /products [not-handled] → /blog [not-handled] → /docs [openapi-swagger-ui-html] → /login [webapp-form-login] → /register [webapp-form-signup] → /signup [webapp-form-signup] |
Omegatech LTD |
NL |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
147.182.149.75 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
159.89.127.165 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ai-devbox-1 |
142.93.143.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| canary-farm-1 |
143.110.213.72 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
142.93.129.190 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
NL |
| ai-devbox-1 |
164.90.228.79 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
196.89.218.205 |
15 |
/ [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] |
Office National des Postes e |
MA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 13 sources sent credentials → 9 got a shell (69%) → 5 ran a command (56% of shell-getters, 38% of sources)
- event level: 374 credential attempts → 184 accepted logins → 148 commands (80% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 26 attempts
New commands this window (0 of 6 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 55 |
2 |
109.160.32.113 |
"uname -m | awk '{printf $1}'" |
| 55 |
2 |
109.160.32.113 |
"uname -s -v -n -r -m" |
| 16 |
2 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 16 |
2 |
92.118.39.49 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 3 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 3 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
Credentials: 291 distinct pairs offered this window, 191 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 2 |
admin |
Computer123456 |
| 2 |
admin |
Company@2023 |
| 2 |
ubuntu |
yY@1234 |
| 2 |
root |
server.2016 |
| 2 |
admin |
Company@2025 |
| 2 |
admin |
Computer1234 |
| 2 |
root |
!@123qwaszx |
| 2 |
root |
PASS@WORD123 |